Therefore, knowledge about cybercrime trends becomes essential to conduct effective defense actions. Technological evolution demands up-to-date studies to defend against AI being used as a malicious tool by cyber criminals. In this sense, this research aims to fill this gap. The objective is to present systematic literature research to identify publications on AI-based cyber-attacks in the literature and analyze them for their applicability to cyber security in Industry 4.0. The analysis intends to provide the research community with insights to structure defenses against potential future threats from the use of AI.
2. Artificial Intelligence
AI dates to the 1950s and recent AI technological advances have impacted growth in innovation and automation in manufacturing. Despite the inherent benefits of AI technologies, the use of these techniques has sparked debates about their use in malicious ways
[8]. AI is a field of computer science that develops theories, methods, techniques, and systems to simulate and expand human intellect into machines
[9]. The goal of AI is to endow machines with human intelligence. Machine learning is a method to implement AI using algorithms to analyze and learn from data. Deep learning is a technology used in the process of machine learning, enabling the expansion of the scope of AI
[10]. The essence of AI is based on the context that human intelligence can be accurately described, enabling its replication by machines and/or software
[11].
AI addresses topics such as reasoning, knowledge, planning, automation, machine learning, natural language processing, robotics, human intelligence, and cyber security
[11]. AI applications form a multidisciplinary intersection with cyber security issues. However, as AI technologies become more advanced and ubiquitous, cyber-attacks on CPS are on the rise, exploiting the interface between the connection of physical and cyber elements
[12][13]. The threat landscape involves multiple players, attackers seek different types of vulnerabilities to launch their attacks. These attacks include the complexity and sophistication of advanced persistent threats, malicious actions in cyberspace, and monetization of cybercrime
[6]. The cyber security community needs to understand how AI can be used for cyber-attacks and identify its weaknesses in order to implement defense actions
[14].
2.1. Machine Learning
Machine learning (ML) is a method used to implement AI algorithms to analyze data, learn from the data, and make decisions about real-world events
[10]. ML systems can be divided into (i) systems for initial training on the dataset; (ii) systems already trained for later decision-making
[15]. Given the large amount of data available, there is a strong demand for the application of ML techniques.
Researchers apply various approaches to deal with this large amount of data. Industry applies these techniques to extract relevant data. ML relies on different algorithms to solve data problems. The type of algorithm depends on the problem to be solved, considering the variables involved in the learning process
[16]. In the age of digital transformation, ML is a relevant discipline in the research field of AI-based cyber security. Importantly, AI, particularly ML, has been used in both attack and defense of cyberspace. From the attacker’s point of view, ML is employed to compromise cyber protection strategies. On the defense side, ML is applied to provide robust resilience against threats, in order to adaptively minimize the damaging impacts of cyber-attacks
[17].
ML algorithms can be categorized into supervised learning, unsupervised learning, and reinforcement learning
[18]. The following is a contextualization of these algorithms. Supervised learning is when the model learns from predefined results by using past values for the target variable to learn what its output results should be
[15]. Unsupervised learning, unlike supervised learning, does not have predefined results for the model to use as a reference for learning. The model works with a set of data and tries to find patterns and differences in this data
[15]. Supervised and unsupervised learning applications are widely used for intrusion, malware detection, cyber-physical attacks, and data privacy protection
[19][20][21]. Reinforcement learning, a branch of ML, demands sequential actions in an omitted way with or without knowledge of the environment, thus allowing a closer approximation to human learning
[17].
There are several ML algorithms used in industry. For example: (i) Supervised Learning: Additive Models, Artificial Neural Networks, Bayesian Networks, Decision Tree, Random Forest, K-Nearest Neighbors, Logistic Regression, Naïve Bayesian Networks, and Regression Tree; (ii) Unsupervised Learning: K-means, and Self Organizing Map; (iii) Reinforcement Learning: Smart, and Pilco
[8][22][23].
2.2. Deep Learning
Deep learning (DL) is a powerful ML technique that seeks to establish an artificial neural network that simulates the human brain for analytical learning in the interpretation of data
[24]. An artificial neural network is a series of algorithms that seek to recognize implicit relationships in a dataset, through a process that mimics the way the human brain works. Neural networks refer to a system of neurons, either organic or artificial in nature
[16].
DL uses multiple layers to build artificial neural networks with the ability to make intelligent decisions by processing large amounts of data with a high level of complexity without human intervention
[25]. DL techniques can process a large amount of cyber security-related data made available in cyberspace. Researchers use ML and DL methods to detect malicious behavior in information systems arising from cyber-attacks
[26]. The applications of DL techniques provide proactive monitoring in the industrial environment, producing essential data about the manufacturing process
[23].
The combination of deep learning and reinforcement learning indicates excellent effectiveness and efficiency for cyber security applications dealing with increasingly dynamic and complex cyber-attacks
[17]. There are several deep learning models used in industry. For example, (i) Supervised Learning: Convolutional Neural Network, Multiple Linear Perceptron, Recurrent Neural Network, Restricted Boltzmann Machine, Multiple Linear Perceptron, and YOLO v5; (ii) Unsupervised Learning: Auto Encoders, CAMP-BD, and Restricted Boltzmann Machine
[8][17][22][23].
3. Cyber Security
Cyber security is constantly changing as the research environment changes rapidly. The cyber security community recognizes that cyber threats cannot be totally eliminated
[27]. Therefore, research and technology development is essential to reduce the harmful impacts of cyber-attacks
[28]. Research has sought a more proactive approach to preventing or mitigating security incidents before they cause damage in cyberspace.
Cyber security threats are growing exponentially, becoming one of the main challenges for companies, due to the disruptive concepts of digital transformation present in the Industry 4.0 ecosystem
[29]. Cyber security makes use of various measures, methods, and means to ensure that systems are protected against threats and vulnerabilities. Cyber-attacks aim to gain access to connected services, resources, or systems in an attempt to compromise their confidentiality, integrity, and availability
[30][31].
To increase the level of cyber security, intelligent methods for cyber defense must be developed to cope with the diversity and dynamics of attacks
[9]. Cyber security has evolved over the years from a technical domain focused on network security to an issue of global concern. It is a topic that is becoming increasingly important on the agenda of business leaders
[32].
Proactively addressing AI-based security issues is a key factor for an industrial environment with smart factories, autonomous systems, CPS, IoT, cloud computing, and big data
[33]. In this sense, AI has the potential to automatically provide significant cyber security insights without human interaction. AI and ML are potentially transformative tools for cyber security and information sharing in cyberspace
[34].
4. Industry 4.0
Industry 4.0, a term that originated in Germany in 2011, is a product of the information technology age. Technological development paves the way for intelligent factories with machines based on automated and digitized manufacturing systems
[35]. These systems comprise computer network technologies and physical processes that enable the interconnection of the physical and technological environment and enable data processing through technologies such as the Internet
[36].
The incorporation of digitization into industrial activity, integrating physical and virtual components, is a characteristic of Industry 4.0. This integration allows greater data capture, transport, storage, and analysis. Connected products, machines, and equipment became sources of data and information to support decision-making. The main industrialized countries have focused on the development of Industry 4.0, as a strategic instrument of industrial policy to increase their competitiveness
[37].
Intelligent manufacturing processes use AI in automation systems for machine interaction. Intelligent automation platforms play a key role in obtaining, processing, and interpreting data generated in industrial production
[38]. AI provides information to track all activities in the manufacturing process. It makes it possible to improve management to increase or decrease production, considering demand, aiming to reduce downtime to ensure constant efficiency of the production line
[39].
While technological advancement is a competitive differentiator, factors such as smart production, smart maintenance, smart logistics, CPS connectivity, machine-to-machine variations, and production data quality demand actions with greater cyber security control in the Industry 4.0 ecosystem
[35][40][41].
5. Cyber-Physical Systems
Cyber-Physical Systems are one of the most significant advances in the development of computer science
[42]. In CPS there is a combination of networked physical processes integrated with cybernetic components, sensors, and actuators, which interact in a process monitoring cycle, providing information for decision-making in the production line
[43].
Industry 4.0 seeks to create smart factories where CPS operations are monitored, controlled, coordinated, and integrated by a computing and communication core. The human-machine and machine-to-machine interactions are essential concepts in the context of smart manufacturing. Such production makes use of technologies for flexible, intelligent, and reconfigurable manufacturing according to market dynamics
[1]. CPS, considering automated process information, make use of AI algorithms to automatically obtain data, aiming at individual process analysis and monitoring
[44].
With the exponential growth of CPS, new cyber security challenges have emerged. The exploitation of vulnerabilities in integrated and connected cyber-physical systems, due to technological evolution, demands technical detection measures of the application, transmission, and perception layers of CPS
[45]. The focus of CPS security has shifted from computer risk assessment to risk in the computational network, in which there is the presence of embedded systems with sensors, actuators, and information system processing, in conjunction with a communication layer
[37].
The increasing use of connected technologies makes the manufacturing system vulnerable to cyber risks
[41]. Cyber security for CPS is attracting interest from academia and industry, though it is problematic because it benefits both defensive and offensive sides
[46]. Even though companies are investing resources to develop cyber defense applications, the number of cyber-attacks has increased in quantity and complexity with the application of AI.